Is CVE-2026-63647 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63647 being exploited in the wild.

How severe is CVE-2026-63647?

Informational severity, published 18 September 2026.

Which products and versions are affected?

1Panel-dev CordysCRM prior to 1.7.2.

Is there a fix for CVE-2026-63647?

A patch was published on 2026-06-17: Fix merged in version 1.7.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63647 attacked?

It is attacked over the network.

Am I affected by CVE-2026-63647?

Check whether you run 1Panel-dev CordysCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63647: CordysCRM SSE endpoints authentication bypass

CVE-2026-63647 · Severity: info · Published 2026-09-18

CordysCRM is an open source customer relationship management system that manages customer interactions, workflows, and alerts. Unauthenticated attackers can access other users' workflow events, approval requests, and alerts by exploiting unprotected Server-Sent Event endpoints, or inject fake messages into other users' notification streams. This allows attackers to spy on other users' activities and disrupt their workflow.

Technologies: 1Panel-dev CordysCRM. Vendors: 1Panel-dev.

Quick answers

Is CVE-2026-63647 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63647 being exploited in the wild.
How severe is CVE-2026-63647?: Informational severity, published 18 September 2026.
Which products and versions are affected?: 1Panel-dev CordysCRM prior to 1.7.2.
Is there a fix for CVE-2026-63647?: A patch was published on 2026-06-17: Fix merged in version 1.7.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63647 attacked?: It is attacked over the network.
Am I affected by CVE-2026-63647?: Check whether you run 1Panel-dev CordysCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The SSE /subscribe, /broadcast, and /close endpoints are exposed as public paths by ShiroFilter without requiring authentication, and trust the caller-supplied userId parameter instead of deriving identity from an authenticated session. An attacker can craft requests to read another user's SSE stream, inject SYSTEM_HEARTBEAT messages, or terminate channels. The vulnerability is fixed in version 1.7.2 by removing the /broadcast endpoint and enforcing proper authentication checks.

Affected products

1Panel-dev CordysCRM prior to 1.7.2

Timeline

2026-09-18: disclosed
2026-06-17: patched: Fix merged in version 1.7.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.